OSG-SEC-2026-09-22 IMPORTANT-Apptainer 1.5.4 fixes local privilege escalation vulnerability

Dear OSG Security Contacts,

Apptainer 1.5.4 has been released with a fix for a high-severity local privilege escalation vulnerability affecting Apptainer 1.5.0 through 1.5.3 when installed in SUID mode [1]. No CVE has been assigned yet.

## WHAT IS THE VULNERABILITY

The vulnerability affects the Apptainer apptainer-suid component and involves the --cdi-dirs option. A local unprivileged user can exploit this issue to escalate privileges to root on the affected host. The issue is specifically relevant to SUID installations.

## IMPACTED VERSIONS

OSG worker nodes that have Apptainer 1.5.0–1.5.3 installed in SUID mode are potentially affected. Successful exploitation could result in root privileges on that worker node.

## MITIGATION

Where upgrading is not immediately possible, the upstream advisory identifies the following mitigations[1]:

Remove the apptainer-suid package and use only the unprivileged apptainer package, if that is an option. Alternatively, set allow **setuid \= no** in apptainer.conf.

As an additional mitigation, administrators may also set enable underlay \= no, as the known exploit utilizes the deprecated --underlay option.

Administrators should consider the impact of these settings on existing OSG container workflows before disabling them.

## WHAT YOU SHOULD DO

Administrators should verify the installed Apptainer version and whether the SUID installation is enabled on worker nodes.

Upgrade Apptainer to version 1.5.4 or later. The upstream release specifically prevents non-root users from using --cdi-dirs when Apptainer is running in SUID mode. It controls the default directories used for Container Device Interface (CDI) specifications.

Apptainer is distributed for RHEL in EPEL, and 1.5.4 is not yet available there, but rpm packages and debian packages are available for download from the github release page [2].

## REFERENCES

[1] https\://github.com/apptainer/apptainer/security/advisories/GHSA-4wg8-vhjg-jq8p
[2] https\://github.com/apptainer/apptainer/releases/tag/v1.5.4

## Published on 10/08/2026